CVE-2026-102435 in Ultra Addons for Contact Form 7 Plugin
Summary
by MITRE • 11/02/2026
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Ultra Addons for Contact Form 7 plugin for WordPress contains a critical security flaw identified as an arbitrary file deletion vulnerability, affecting all versions up through and including version 3.5.54. This weakness stems from insufficient validation of file paths within the _getObjAttr function, which fails to properly sanitize user-supplied input before using it in filesystem operations. The absence of rigorous path traversal checks allows attackers to manipulate directory structures, leading to the deletion of arbitrary files on the compromised server. Such a vulnerability is particularly dangerous because it bypasses standard access controls when combined with other conditions, creating a pathway for severe system compromise that extends far beyond simple data loss or defacement.
The operational impact of this flaw is significant due to its potential to facilitate remote code execution. By deleting critical configuration files such as wp-config.php, an attacker can disrupt the application's integrity and potentially expose sensitive database credentials or other security parameters. More critically, if specific conditions are met, the deletion action serves as a precursor to executing arbitrary commands on the server. The vulnerability relies on a complex interaction involving the PDF Generator add-on being active and at least one Contact Form 7 form configured for PDF generation. This setup enables a PHP Object Injection attack vector where an unauthenticated attacker can leverage the WPCF7_Submission POP gadget chain. Through this mechanism, the attacker triggers the __destruct() method during object serialization processes, which ultimately executes the file deletion logic with elevated privileges inherent to the web server process.
From a classification perspective, this vulnerability aligns closely with CWE-22, specifically Improper Limitation of a Pathname to a Restricted Directory, as it involves path traversal leading to unauthorized filesystem access. It also relates to CWE-436, Interpretation Error, due to the flawed parsing of file paths that allows malicious input to be interpreted as valid system commands or targets. In terms of offensive security frameworks like MITRE ATT&CK, this exploit maps to T1070, Indicator Removal on Host, specifically under subtechniques related to File Deletion. Furthermore, the use of a POP gadget chain places it within the realm of PHP Object Injection attacks, which are often categorized under privilege escalation or defense evasion tactics depending on the ultimate goal of the attacker.
Mitigation strategies must focus on immediate remediation and long-term hardening. The primary recommendation is to update the Ultra Addons for Contact Form 7 plugin to a version newer than 3.5.54, where this path validation issue has been addressed by developers implementing strict input sanitization and allowlisting of permissible file paths. Administrators should also ensure that unnecessary add-ons like PDF Generator are disabled if not actively required, thereby reducing the attack surface available for gadget chain exploitation. Additionally, enforcing least-privilege principles on web server configurations can limit the damage caused by any successful deletion attempt. Regular security audits and monitoring of filesystem integrity changes will help detect such anomalies early, providing an additional layer of defense against this type of vulnerability.